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_(U) MESSAGE FROM THE ACTING INSPECTOR GENERAL 














29 April 2016 


(U) On behalf of the National Reconnaissance Office (NRO) Office of 
Inspector General (OIG), I am pleased to submit this report highlighting 
the OIG's activities and accomplishments for the period 1 October 2015 
through 31 March 2016. The activities described in this report exemplify 
our continuing commitment to improving the efficiency and effectiveness 
of NRO programs and operations. 


(U//FOUO) Beginning in Fiscal Year 2016, the OIG made several changes 
to our semiannual reports. First, we now include a highlights section in 
our Semiannual Reports in order to call attention to projects, activities, 
and accomplishments that may be of particular interest to the 
Committees. Second, starting with our Annual Report to Congressional 
Intelligence Committees, we changed the appearance and format of our 
reports to Congress to differentiate them from our audit, inspection, 
special projects, and investigative products. Finally, beginning with our 
next Semiannual Report to Congress, we will identify and highlight those 
findings and recommendations of particular significance, and include the 
status of each of the associated recommendations. 


(U) I performed the duties of the Inspector General while we await the 

appoint a new Inspector General for the NRO. 

Similar Assistant Inspector General for (b)(3) 
Inspections, performed the duties of the Deputy Inspector General. 








(ULLFRHO) As is always the case, we enjoyed a collaborative relationship 
with Director Sapp and with NRO’‘s leadership and workforce. Director 
Sapp and her management team are actively engaged in addressing open 
recommendations and implementing corrective actions. We did not 
experience any issues related to access to NRO records or personnel. 


(U) I very much appreciate the cooperation and support of the Congress 
and its staff as we continue to affect positive change at the NRO. I 
would also like to thank the dedicated and professional NRO OIG staff for 
their continued hard work and commitment to providing effective 
oversight of NRO programs and operations. 














Acting Inspector General 


ill 
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(U//FOU®)_During this reporting period, the National Reconnaissance 
Office (NRO) Office of Inspector General (OIG) focused the resources of 
its Audits, Inspections, Investigations, and Special Projects Divisions to 
address management challenges or issues of greatest risk within the 
NRO. Specifically, the OIG performed work on 23 projects, eight of which 
were completed and 15 of which are ongoing. The projects derive from 
previous NRO OIG annual work plans; address mandated requirements; 
respond to alleged violations of law, regulation, or policy; or evaluate 
emerging issues. The OIG’s efforts enhanced the economy, efficiency, 
and effectiveness of NRO programs; assisted in detecting and preventing 
fraud and abuse; safeguarded taxpayer investments; and supported the 
mission of the NRO. 


(U//FOUS}As part of its Fisca/ Year 2016 Annual Work Plan, the OIG 
conducted a Special Review of Office of Space Launch Contract 
Procurement Practices. The Special Projects Division evaluated whether 
the Office of Space Launch (OSL) adhered to NRO procurement policie 

for its “other than full-and-open-competition” contract awards. nc 

















The report included six 
recommendations to address the issues identified. 





(U//FOU@) The OIG suspended two planned projects that were initiated 
during this reporting period. Both projects lacked established criteria to 
use for a meaningful assessment of the respective programs. 


> (U//FOUS) On 12 February 2016, the NRO and National Security 
Agency (NSA) OIGs mutually agreed to suspend their Joint Inspection 
of the National Reconnaissance Office Signals Intelligence Compliance 
Program.’ The inspectors reviewed 
interviewed key officials. 














requested that the key stakeholders in each agency provide their 
respective OIGs with status updates every 90 days. 





ib (U//PODSThe NRO OIG conducted this joint inspection with the National Security Agency (NSA)/Central Security Service (CSS) 
Office of Inspector General. 
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(U/7FO¥Q) The OIG completed three mandated projects during this 
reporting period. First, the OIG completed was the congressionally- 
mandated Audit of the National Reconnaissance Office Fiscal Year 2015 
Financial Statements. The audit resulted in an unmodified opinion, closed 
one material weakness and downgraded another to a significant 
deficiency, leaving three significant deficiencies that still constitute 
considerable concern. Second, the OIG completed the /nspection of the 
National Reconnaissance Office Personnel Accountability in Conjunction 
with Natural or Manmade Disasters as required pursuant to Department 
of Defense Instruction (DoDI) 3001.02, “Personnel Accountability in 
Conjunction with Natural or Manmade Disasters.” The OIG found that 
the NRO is compliant with 12 of the 13 applicable responsibilities for 
personnel accountability, and is in the process of finalizing procedures to 
address the remaining responsibility. Third, the congressionally- 
mandated Examination of NRO FY 2015 Improper Payment Compliance 
found that the NRO met the requirements, but noted areas for potential 
improvement. 


(U/JFOUQ) With respect to investigative prosecutions and civil actions, 
the Department of Justice reached a civil settlement for $53,000 
originating from a 2015 OIG investigation involving a consulting firm that 
concealed a business relationship with a prime contractor from the 
government during a contract competition. In addition, an OIG 
investigation resulted in a criminal conviction of a contractor employee 
who, while working in an NRO facility, used NRO systems to sell 
counterfeit sports apparel to NRO personnel for several years, importing 
the counterfeit goods directly from a Chinese distributor. 
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(43) FIGURE i: INAUGURAL ISSUE OF THE IG CORNER 


(U//PONQ) Finally, to document potentially 
emerging issues, in March 2016, the OIG 
planned a new publication, which will be 
called the IG Corner (see Figure 1). This 
new publication will not be a traditional OIG 
(b)(1) report derived from audit, inspection, or 
(b)(3) investigation work. Rather, its purpose is to 
go beyond the traditional OIG products to 
inform and allow its readers to assess 
whether the information presented is 
consistent with their understanding of the 
NRO, its mission, and NRO management 
priorities.” 


“"TRIINFLIn preparing for the first edition of the IG Corner, the OIG 
examined NRO priorities as reflected by how it spends its moneys (b)(1) 
FY 2015.° Specifically, the OIG reviewed information on how the 





ee IG Corner 





















































NRO spent its funds, who was paid, what the NRO bought, and when the (b)(3) 
NRO spent its funds. A summary of the spending information will be 
provided in this first OIG Corner issue. 
(b)(1) 
(b)(3) 
(U//PONQ) The IG Corner will not provide findings and recommendations. 
(b)(3) 








“ (U//FOD@, For the purposes of this publication, the OIG examined and reported on the execution of all funds available in 
FY 2015, regardless of fiscal year appropriation. This differs from information published by the NRO‘s Business Plans and 
Operations Directorate, which generally reports execution by budget fiscal year appropriation. 
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(U) SUMMARY OF COMPLETED AND ONGOING PROJECTS 


(U//FOUO) Table 2 is a list of the completed projects for this semiannual 
reporting period. Following the table are short descriptions of the 
conclusions and recommendations made for each project. 


(U) TABLE 2: COMPLETED PROJECTS — OCTOBER 2015-March 2016 


Title Date Completed 

es of the Mission Integration Directorate’s Support to 29 October 2015 
q 

(U) Audit of the National Reconnaissance Office Fiscal Year 2015 / 13 November 

Financial Statements i 2015 


(U) Inspection of the National Reconnaissance Office Personnel 


Accountability in Conjunction with Natural or Manmade Disasters a7 ee en) 





(U) Suspension of Joint Inspection of the National Reconnaissance | 12 February 
Office Signais Intelligence Compliance Program i 2016 
2march 2016 © (P){9) 











4 March 2016 
31 March 2016 


(U) Examination of NRO FY 2015 Improper Payment Compliance 
(U) Special Review of Office of Space Launch Contract Procurement 
Practices 


(U) Suspension of Inspection of NRO Physical Security Program (NRO 
Headquarters and Surrounding Facilities) 


| 
j 
i 
1 
} 


i 31 March 2016 
Table is UNCLASSIFIED 


(U) COMPLETED PROJECTS - RECOMMENDATIONS 


(U//FONQ) Inspection of the Mission Integration Directorate’s 

Support to Users. The OIG found that military and national customers 

were Satisfied with the relationship and support provided by the NRO and 

the Mission Intearation Directorate (MID). (b)(3) 
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(UI/F OQ) Audit of the National Reconnaissance Office Fiscal 
Year 2015 Financial Statements. The NRO received an unmodified 
opinion on its FY 2015 financial statements. The auditors identified three 
significant deficiencies and made the following recommendations for their 
remediation: 











(U) Inspection of the National Reconnaissance Office Personnel 
Accountability in Conjunction with Natural or Manmade 
Disasters. The OIG observed that the NRO does not currently have 
approved internal procedures that pertain to personnel accountability (PA) 
reporting for NRO Department of Defense (DoD) Cadre personnel. 
However, the PA Program Officer is in the process of finalizing these 
procedures. Despite the lack of approved procedures, the NRO has 
established a program that sufficiently accounts for both its DoD-affiliated 
and other personnel. 


(U//FONQ) Suspension of Joint Inspection of the National 
Reconnaissance Office Signals Intelligence Compliance Program. 
The NRO and the NSA OIGs (b)(5) 

















specific concerns and made the following recommendations that need to 
be addressed before the OIGs can move forward with the joint 
inspection: 
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(U) Examination of NRO FY 2015 Improper Payment Compliance. 
The NRO OIG reported that the NRO met the requirements established by 
the Office of Management and Budget (OMB) and Congress related to 
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improper payments, but noted the following for potential improvements. 
The NRO should 


>» (U) improve the supporting documentation for the Improper Payment 
Information Act of 2002 risk assessment; 


>» (U) improve the supporting documentation for duplicate payment 
testing; 


> (U) develop actionable alternatives to address the FY 2013 findings; 
and 


» (U) ensure compliance with NRO Acquisition Manual requirements for 
improper payment returns to the NRO. 





(U/7FO¥O). Special Review of Office of Space Launch Contract 








Procurement Practices. The OIG reported that OSL (b)(5) 











‘The report 





included the following recommendations: 


» (U//FO¥QLOSL Contracts should review and determine the 
appropriateness of the sole source acquisitions for two acquisition 
support contracts (CLOSED); 


> (U//PFO¥OLThe Launch Support Division should develop a succession 
plan if the sole source requirement for the acquisition support 
services remains (OPEN); 


> (U//POXQ) OSL Contracts should document the file for one particular 
contract, explain the basis for the sole source award, establish a 
process to ensure that all sole sources have proper approvals before 
award (CLOSED); 


(U//FONQ) OSL Contracts should establish a written process or policy 
to ensure OSL (1) conducts appropriate market research prior to the 
initiation of any sole source contract or (2) documents and supports 

the reason for not conducting market research (CLOSED); 


> (U//FO¥Q) OSL Contracts should obtain proper approvals for two 
specific contract changes (CLOSED); and 


> (U/JFSUQ) The Office of Contracts Policy should emphasize the 
review of all relevant sole source justifcation supporting 
documentation through existing Contract Compliance Reviews in 
accordance with policy (CLOSED). 


W 


(U) Suspension of Inspection of NRO Physical Security Program 
(NRO Headquarters and Surrounding Facilities). The OIG reported 








(b)(3) 


PKS) 
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(U//FO ble 3 is a list of the ongoing projects for this semiannual 
reporting period. Following the table are short descriptions of the 


objectives for each project. 


(U) TABLE 3: ONGOING PROJECTS — OCTOBER 2015-March 2016 


Title 

(U) Audit of the National Reconnaissance Office Aerospace Data 
Facility Colorado Facilities Infrastructure 

(U) Audit of Project Management within the Ground Enterprise 
Directorate 

(U) Follow-up Evaluation of National Reconnaissance Office 
Classification Management under Public Law 111-258, the Reducing 
Over-Ciassification Act 











(U) Follow-up Audit of the Effectiveness of Management Oversight 
of Federally Funded Research and Development Centers in the 
Systems Engineering Directorate 

(U) Fiscal Year 2015 Assessment of the National Reconnaissance 
Office Purchase Card Proaram 

















(U) Joint Inspection of the Aerospace Data Facility Colorado, 
Nationai Security Agency/Central Security Service-Colorado, and 
National Geospatial-Intelligence Agency-Denver 

(U) Joint Review of the National System for Geospatial Intelligence 
(NSG) Future Capability Development 

(U) Inspection of NRO Supervisory Control and Data Acquisition 
Systems (SCADA) 


U) Inspection of NRO 


(U) Inspection of the NRO Defense Civilian Intelligence Personnel 
System (DCIPS) Performance Management Process 

(U) Office of Inspector General Fiscal Year 2016 Independent 
Evaluation of National Reconnaissance Office Compliance with the 
Federal Information Security Modernization Act of 2014 

(U) Audit of the National Reconnaissance Office Fiscal Year 2016 
Financial Statements 

(U) National Reconnaissance Office GEOINT -Financials Statement 
on Standards for Attestation Engagements No. 16 Examinats 
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20 July 2015 


20 July 2015 iG 


3 November 2015 


4 November 2015 


19 November 2015 


7 December 2015 


29 January 2016 
2 February 2016 
8 February 2016 


18 February 2016 


25 February 2016 


1 March 2016 


18 March 2016 
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(U) ONGOING PROJECTS - OBJECTIVES 


(U//FO Audit of the National Reconnaissance Office Aerospace 
Data Facility Colorado Facilities Infrastructure. Objectives: 
Evaluate the Aerospace Data Facility Colorado (ADF-C) management of 
facilities infrastructure; and assess the processes that identify facilities 
requirements, prioritize and budget for those requirements, and 
implement actions intended to maintain and improve the conditions of 
ADF-C facilities. 





(U) Audit of Project Management within the Ground Enterprise 
Directorate. Objectives: Determine the extent to which GED is 
applying systems engineering and project management principles during 
the initial planning for the selected projects and contract development 
efforts. 


(U) Follow-up Evaluation of National Reconnaissance Office 
Classification Management under Public Law 111-258, the 
Reducing Over-Classification Act. Objective: Review progress made 
on recommendations cited in the prior evaluation report issued on 

30 September 2013. 














(U) Follow-up Audit of the Effectiveness of Management 
Oversight of Federally Funded Research and Development 
Centers in the Systems Engineering Directorate. Objective: 
Evaluate the effectiveness of management changes made within the 
Systems Engineering Directorate to address prior audit findings and 
recommendations. 





(U) Fiscal Year 2015 Assessment of the National Reconnaissance 
Office Purchase Card Program. Objective: Conduct a periodic risk 
assessment of NRO’s purchase card program to analyze the risks of 
illegal, improper, or erroneous purchases. 











ii 
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(U// DUO) Joint Inspection of the Aerospace Data Facility 


Colorado, National Security Agency/Central Security Service— 
Colorado, and National Geospatiai-Intelligence Agency-Denver. 
Objective: The NRO OIG and the OIGs from NSA, the National 
Geospatial-Intelligence Agency (NGA), and Office of the Inspector 
General of the Intelligence Community will evaluate the effectiveness and 
efficiency of the ADF-C, NSA-Colorado, and NGA-Denver in performing 
their missions, including an on-site inspection. 


(U//FO Joint Review of the National System for Geospatial 
Intelligence (NSG) Future Capability Development. Objectives: 
The NGA and NRO OIGs will assess the effectiveness of the processes by 
which the NGA identifies and validates NSG geospatial intelligence 
capabilities to be delivered by NRO-acquired systems; and assess the 
NRO-acquired systems' effectiveness in meeting the desired capabilities. 


(U//FONQ) Inspection of NRO Supervisory Control and Data 
Acquisition Systems (SCADA). Objective: Assess NRO’s SCADA 
program and related NRO industrial control systems. 



































(U) Inspection of NRO (b)(3) 
Objective: Assess the efficiency and effectiveness of 
the NRO and its (b)(3) 


compliance with internal and external policies. 





(U) Inspection of the NRO Defense Civilian Intelligence 
Personnel System (DCIPS) Performance Management Process. 
Objective: Assess the NRO’s compliance with DoDI 1400.25, Volume 
2011, DoD Civilian Personnel Management System and other regulatory 
guidance. 


(U) Office of Inspector General Fiscal Year 2016 Independent 
Evaluation of National Reconnaissance Office Compliance with 
the Federal Information Security Modernization Act of 2014 
(FISMA). Objectives: Independently assess NRO compliance with 
FISMA requirements and its implementing regulations and guidance; 
review the internal controls and compliance with laws and regulations 
related to the NRO information security program and practices; and 
follow up on the status of prior-year findings and recommendations. 


12 
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(U) Audit of the National Reconnaissance Office Fiscal Year 2016 
Financial Statements. Objectives: Determine whether the financial 
statements and related notes are presented fairly in all material respects, 
in accordance with all applicable guidance to include guidance issued by 
the Federal Accounting Standards Advisory Board and OMB; review 
internal controls and compliance with laws and regulations; and follow up 
on the status of prior-year findings. 





(U) National Reconnaissance Office GEOINT-Financials 
Statement on Standards for Attestation Engagements No. 16 
Examination. Objectives: Report on the fairness of the presentation of 
management's description of the GEOINT [Geospatial-Intelligence]- 
Financials application and the suitability of the design and operating 
effectiveness of the controls to achieve specific control objectives. 





13 
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(U//PONQ) The OIG Investigations Division conducts criminal, civil, and 
administrative investigations into alleged violations of federal law, 
regulation, and policies involving NRO funds, operations, and programs. 
During this reporting period, the Investigations Division produced 15 
Reports of Investigation. The OIG presented 14 of these reports to the 
NRO Office of Contracts (OC) for suspension and debarment 
consideration. The OC did not advance any of these cases for action by 
the Air Force General Counsel for Contractor Responsibility. 


(U//FOQ) In the first half of FY 2016, the Investigations Division 
responded to 175 allegations. Figure 3 below illustrates the types and 
percentages of these cases opened during this reporting period—the ratio 
of allegations is similar to the ratio in the prior semiannual reporting 
period. The predominant number of cases involves procurement-related 
fraud, including procurement integrity violations and other types of false 
claims, regulatory and non-criminal matters such as ethics violations, 
privacy and personally identifiable information-related complaints, and 
other non-criminal employee misconduct. 


(U) Figure 3: SUMMARY OF ALLEGATIONS RECEIVED BY THE 
NRO OIG INVESTIGATIONS DIVISION 































































































































































































































Child Conflict of Theft False Procurement 
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~~ 1% 

Product Substitution 





<1% 


Regulatory / Other 
Non-criminal 
False Claims (labor, 38% 
qui tam, other) 


41% 


Figure is UNCLASSIFIED 
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(U/JPOUQ) The Investigations Division completed 12 investigations of 


labor miscRarging by NRO contractor personnel during this reporting 

period. In total, these investigations identified approximately (b)(3) 
in funds recoverable to the NRO. The United States Attorney's Office 

declined prosecution for each of these cases. The OIG referred each case 

to the OC for administrative action within the terms of the affected 

contracts, to include financial restitution, and the removal of the 

offender’s security clearance. 














(U//POBA).The OIG also investigated a government manager for 
inappropriate use of his official position to influence a competition and 
award of contracts to two individuals with whom the government 
manager had pre-existing personal relationships. The manager’s actions 
violated multiple provisions of the Code of Federal Regulations regarding 
ethical conduct of Executive employees, to include the use of office for 
private gain and the requirement for government officers to act 
impartially. 


(U/JPONQ) Two of the identified labor mischarging cases involved 

employees of the same prime contractor assigned to different NRO 

programs who charged hours to their respective contracts in a manner 

that violated the contract’s Statement of Work (SOW). Although the 

SOW limited performance of the employees’ duties to NRO facilities, the 

employees worked from home and other locations with approval from the 

company managers, but without the consent and knowledge of the 

government. This resulted in improper charges for several years 

amounting to approximately respectively. In each (b)(3) 
case, the NRO removed the employee's security access. 














(U/PONQ) The OIG investigated a contractor employee who removed 
computer equipment from his employer’s facility while executing his 
duties as an Information Systems Security Officer. Some of the items 
were allegedly government furnished equipment (GFE). The OIG 
recovered the equipment, but found no evidence that it was GFE. The 
OIG returned the equipment to the company, which chose not to seek 
charges against the employee. The NRO terminated the employee's 
access. 





Grey tte Department of Justice reached a civil settlement for 
$53,000 originating from an OIG investigation involving a consulting firm 
that concealed a potential organizational conflict of interest from the 
government during a contract competition. Specifically, the consulting 
firm concealed a business relationship with a prime contractor which 
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would have precluded the consulting firm from bidding on the contract. 
The NRO subsequently terminated the contract upon realizing the 
existence of the conflicting relationship between the firm and the prime 
contractor. 


(U//EO8O)_An OIG investigation led to a criminal conviction against an 
NRO contractor who, while working in an NRO facility, used NRO systems 
to sell counterfeit sports apparel to NRO personnel for several years, 
importing the counterfeit goods directly from a Chinese distributor. The 
investigation was a joint effort between the OIG, local police, and 
Homeland Security Investigations personnel. The contractor was 
convicted of a misdemeanor and sentenced to 90 days in jail, all 
suspended. The NRO terminated the contractor’ s security accesses. 
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(U) REVIEW OF LEGISLATION AND REGULATIONS 


(U) The Jnspector General Act of 1978, as amended, requires federal 
agency OIGs to review existing and proposed legislation and regulations 
relating to their agencies’ programs and operations. Based on these 
reviews, the OIGs are required to make recommendations in their 
semiannual reports concerning the impact of the legislation and 
regulations on (1) the economy and efficiency of programs and 
operations of their agencies and (2) the prevention and detection of fraud 
and abuse in programs and operations of their agencies. 


(U) The NRO OIG conducts such reviews and provides comments and 
recommendations to Congress, when warranted, through a variety of 
means including reports and coordination with the Council of the 
Inspectors General on Integrity and Efficiency (CIGIE). For example, 
during this period the NRO OIG reviewed all pertinent draft legislation to 
include the Inspector General Empowerment Act of 2015 and the 
Intelligence Authorization Act for Fiscal Year 2016, and provided 
comments to CIGIE which provided responses on behalf of the IG 
community. 
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(U) As required by the Jnspector General Act of 1978, as amended, this 
Semiannual Report provides information regarding the NRO’s compliance 
with the requirements of the Federa/ Financial Management Improvernent 
Act of 1996 (FFMIA). Specifically, the FFMIA requires organizations to 
implement and maintain financial management systems that are 
substantially in compliance with federal accounting standards and with 
federal financial management systems requirements. 


(U//EQUO) For the FY 2015 reporting period, the NRO OIG contracted 

with the independent public accounting firm of | (b)(3) 
o assess the NRO’s financial systems for compliance with 

applicable laws and standards as part of its Audit of the National 

Reconnaissance Office Fiscal Year 2015 Financial Statements. 

determined that the NRO’s financial systems and related controls 












































(UJTPSNQ) This information is excerpted and summarized from the National Reconnaissance Office Fiscal Year 2015 Agency 
Financial Report. 
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(U) The Inspector General Act of 1978, as amended, requires that OIGs 
report on peer reviews conducted during this semiannual reporting 
period. The purpose of a peer review is to determine whether an 
organization’s system of quality control is suitably designed and whether 
its staff is effectively implementing those quality controls and conforming 
to applicable professional standards. Generally Accepted Government 
Auditing Standards issued by the Comptroller General of the United 
States require that audit organizations performing audits, attestation 
engagements, or both, undergo a peer review at least once every three 
years by reviewers independent of the audit organization to determine if 
an appropriate internal quality control system is in place. Similarly, CIGIE 
established standards for maintaining quality assurance that include 
having external quality assurance reviews of audits, investigations, 
inspections, evaluations, and other OIG activities. 


(U) PEER REVIEW OF THE NRO OFFICE OF INSPECTOR GENERAL 


(U) The NRO OIG did not undergo any peer reviews during this reporting 
period. The NSA OIG conducted the most recent peer review of the NRO 
OIG Audit Division between 1 August 2012 and 31 July 2013. 


(U) PEER INSPECTORS GENERAL 





(U) The NRO OIG did not conduct any peer reviews of other agencies’ 
OIGs during this reporting period. 
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(U) APPENDIX A: SEMIANNUAL REPORTING REQUIREMENTS 


(U) The National Reconnaissance Office (NRO) Office of Inspector 
General (OIG) conducts audits, inspections, investigations, and special 
reviews in accordance with the requirements of Jnspector General Act of 
1978, as amended. Those requirements include promoting economy, 
efficiency, and effectiveness; detecting and preventing fraud and abuse; 
and supporting the mission of the NRO. The Act also establishes 
semiannual reporting requirements that focus on highlighting activities 
and significant issues that arise during the reporting period that may be 
of interest to Congress. Table A1 includes a list of the semiannual 
reporting requirements and the location of the required information in 
this report. 


(U) TABLE A1: SEMIANNUAL REPORTING REQUIREMENTS 


Reporting Requirement Page 
SEC 4(a)(2) Legislation and regulation review 19 
SEC 5(a)(1-2) Significant problems. abuses, and deficiencies; N/A 
recommendations for corrective action 

SEC 5(a)(3) Pricr significant recommendations not yet N/A 
implemented 

SEC 5(a)}(4) Matters referred to authorities resulting in 16 


prosecutions and convictions 






















SEC 5(4)(5) Summary of refusals to provide information 


SEC 5(a)(6) List of reports issued during the reporting period 
SEC Stay) Summary of particularly significant reports 


SEC 5(a)(8-9) Tables showing questioned costs and funds that N/A 

should be put to better use 

SEC 5(a)( 10-12) Summary of reports with no management 
decision; Description and explanation of revised 
Management decisions: Management decisions 
with which Inspector General disagrees 


SEC 5(a)(13) Financial systems compliance with federal 


‘ ai 
requirements 


SEC 5(a)( 14-16) Peer review reporting 
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(U) APPENDIX B: RECOMMENDATIONS OLDER THAN ONE YEAR 


(U) Table B1 summarizes all open recommendations described in 
previous National Reconnaissance Office (NRO) Office of Inspector 
General (OIG) semiannual reports for which corrective action has not yet 
been completed. Details on each open recommendation are included in 
Tables B2-Bi5. 


(U) TABLE B1: RECOMMENDATIONS OLDER THAN ONE YEAR 
Total — 





Report Title . 
(U//FOUS}Audit of the National Reconnaissance Office 
Contractor Wide Area Network 


(U) Audit of the Management of Information Systems 
Privileged Users 


Report Date 
2 September 2010 3 : i 


Open 






| 19November 2010 221 












(U) Joint Inspection of the Aerospace Data Facility 
Southwest and National Geospatial-Intelligence AGENCY 27 December 2011 
Southwest : 


(U) Inspection of Program Security Officers 





3 January 2013 


(U) Audit of the National Reconnaissance Office 
Enterprise Network Management 


(U) Inspection of the 


29 May 2013 











16 August 2013 


















(U) Audit of Chief Information Officer Management of | 
National Reconnaissance Office Information _ 20 December 2013 
Technology : 


(U) Inspection of the Special Communications Office 8 February 2014 









(U)} Joint Inspection of Aerospace Data Facility East 
and National Geospatial-Intelligence Agency-Franconia _ 


(U) Audit of the NRO Management, Oversight, and Use | 
of Federally Funded Research and Development 15 May 2014 6 i 
Centers 


11 February 2014 






(U) Inspection of the Survivability Assurance Office 
(SAO) 


(U) Audit of NRO Cyber Incident Detection and 
Response 


(U) Follow-Up Review of NRO Portable Electronic 
Devices Part Il — Training for Personnel with 
Government-Controlled Portable Electronic Device 
Oversight Responsibilides 


3 November 2014 


| 17 December 2014 10 | 9 







9 January 2015 








25 March 2015 59 33 
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(U //FOUO) Table B2: Audit of the National Reconnaissance Office Contractor Wide 
Area Network 

Recommendation Office __ Status 

(U/TPOReL Recommendation #2 for (he Chief Information Communications i (0) Closure of this recommendation is pending 


Officer (CIO) in coordination with the Director, Office of 
Security and Counterintelligence (OS&CI): Develop and 
implement a suralegy for ine management and operation 
of the Contractor Wide Area Network (CWAN). The 
strategy shoud consider 


Systems Directorate « receipt of supporting documentation. 

(COMMYCIO. i 
i inifial Estimated Completion Date (ECD): 
i December 2013 


i Current ECD: January 2016 (b)(3) 


(b)(5) 


a. developing CWAN policy and procedures 





‘spi i i i i i i 














(U / /FO¥Q) Table B3: Audit of the Management of Information Systems Privileged 
Users 


Recommendation 
{Y/N Recneendten #2 for the Director, COMM: 


Establish and communicate an enterprise-wide process to 
maintain a current, accurate, and complete, centrelized 
list of NRO privileged users that the NRO can rely on to 
meet reporting requirements for identifying privileged 
user and providing and tracking specialized training. 


Office 
COMM 


Status 
(U//FOSQY COMM requested closure in March 2016. 
The OIG subsequently asked for additional information 
to support that the process established by COMM 
meets the intent of the recommendation. The request 
for closure will be considered once the O1G receives 
additional information to support closure, 
initial ECD: September 2013 
| Current ECD: June 2016 

1 











nee ne nt ne ne ne ne 


(U/ /FOUOQ) Table B4: Joint Inspection of Aerospace Data Facility Southwest and 
National Geospatial-Intelligence Agency Southwest 


Recommendation : Office _ Status 

(U/7POPO3 Recommendation ADFSW-11-203: Mission Operations j (U) Due to an NRO restructuring that is still in 
Re-examine and review the current Aerospace Data Directorate (MOD) | transition, the OIG is working with various NRO 

Facility Southwest components to determine and reassign responsibility of 
this recommendation to the appropriate component. 

i 


nitel ECD: October 2012 

















(b)(3) 


H 
H 
H 
i 
i 
H 
H 
H 
i 
; 
i 
i 
; 
; 
i 
; 
i 








(U) Table B5: Inspection of Program Security Officers 


Recommendation Office Status 


£ 
(U) Recommendation #4 for Director, OSSCI in OS&CI (JU) OS&CI reported & launch e@ mandatory Gaining 
coordination with Director, Office of Stretegic Human i courses in February 2016 an Program Securty (b)(3) 
Capital: Establish a baseline core training program for | Officers nave taken the faining. Closure is pending 
Program Security Officers focused on key responsibilities | OIG review of the course content to confirm adequacy, 
and faking Info account lees intelligence i Thal ECD: December 2013 
Community or Department of Defense (DoD) guidance, as i : 
appropriate, and career development programs as | Current ECD: April 2015 
Ghrected by Welt parent organizations. 





i 


este ini i a i i i 


Sane 
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(U) Table B6: Audit of the National Reconnaissance Office Enterprise Network 
Management 



































































Recommendation : _ Status 
(UF Recommendation #/A for the Director, COMM (b)(3) 
in coordination with the Ground Enterprise Directorate 
GED) and MOD 
ial ECD: September 2013 
Curent ECD: February 2016 
(U//FOSQ) Recommendation #7B for the Director, COMM: COMM (b)(3) 
in coordination with GED and MOD: Develop policies and | (1)(3) 
procedures for maintaining ncluding the level of : 
granularity for information maintained therein. 
nitial ECD: September 2013 
: Current ECD: February 2015 
(U//FODR) Recommendation #8 for the Director, MOD in (b)(3) 


coordination with ClO and COMM: Develop and execute 
a strategy for obtaining a complete universe of NRO IP 
address 

















: Initial ECD: December 2013 
utrent ECD: March 2015 
Table is UNC 













(U) Table B7: Inspection of the | (b)(3) 








Recommendation Office Status 


(U/JPOPOLB eccommencdation #1 for the Director, Systems - _ (UffPovewshe review and adjudication of the NRO 
Engineering Directorate (SED): Develop and coordinate struction 130-1-6, NRO Life Cycle Readiness, 
enterprise-wide Echelon 2 procedures that will satisfy the ddendum 1, Users Guide, is in process. 
overarching needs of all acquisition offices and ground al ECD: February 2014 


stauons urrent ECD: December 2016 
is WACL 
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(U) Table B8: Audit of Chief Information Officer Management of National 
Reconnaissance Office Information Technology 


Recommendation 


(U//PFOSQ, Recommendation #2 for the DNRO: Direct 
and ensure that CIO, SED, Business Plans and Operations 
(BPO), and the Office of Policy and Strateqy (OP&S), in 
coordination with other Directorates and Offices as 
appropiate, establish clear and authoritative lines of 
information technology (11 )-related roles, responsibilities 
ownership, and accountability by updating relevant NRO 
policies, directives, instructions, governance plans, and 
Letters of Instruction to clarify tne ClO’s responsibility for 


a. overseeing all [7 at the NRO, including Business [7 
(BIT), Enterprise [7 (EIT), and Mission IT (MIT): 

b. overseeing NRO-wide IT acquisitions by ensuring 
thet all [1 acquisition requests are reviewed and 
approved as part of the “select” phase of the I] 
investment management process: 

c, serving as the single senior NRO official responsible 
for overseeing the selection, planning, review, and 
oversight of LT acquisition activities; and advising the 
DNRO on whether to approve proposed IT acquisitions: 
d, owning, managing, and driving the NRO-wide 
investment management process that advis 
DNRO on the selection, management, and ati! 
all of the NRO’s IT investments to ensure th hey are 
not duplicative, are cost effective, conform to t 
architecture, and effectively support the NRO mission 
goals, and objectives; 

e, advising the DNRO regarding whether to continue, 
modify, or terminate an 17 program or project; and 

f, securing I7 across the NRO by establishing and 
managing an agency-wide information security 
program to ensure that the CIO Aas the authority to, 
and accountability for, tasking and/or directing LT 
security personnel regardiess of parent directorate. 


(U//POSQ\ Recommendation #3 for the CIO: Develop 
and maintain an enterprise IT architecture that is used fo! 
decision-making. This architecture should represent the 
current and target states of IT; comply with DoD 
Architecture Framework and Joint Architecture Reference 
Model requirements; and capture ail NRO IT investments, 
to include BIT, EIT, and MIT. 
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Office 
Director, NRO 
(DNRO) 


COMM/CIO 


30 


= ifs 
nin 





: Status 


| @) Following the approval of the NRO-wide definition 
of 7, the CIO began working with subject matter 
experts fo develop an Implementation plan to address 
this recommendation. OP&S finalized and submited its 
implementation plans to the ClO. Upon approval of the 
plan by the NRO Corporate Council, the CIO began 
updating the relevant 1] related documents. 


initial ECD: June 2015 
Current ECD: December 2016 


(U/JPOS@). The CIO requested closure in July 2015. 

! The OIG asked for and reviewed additional evidence to 
i | support that the agency-wide architecture is completed, 
i and subsequently met with CIO representatives to 

: discuss the results of their evidence review. In 

| December 2015, the CIO reported that this 

| recommendation should remain open pending 


| completion of additional architecture efforts related to 

| the transition to the Intelligence Community 

| Information Technology Enterprise, expected to start in 
: December 2015. 


| Initial ECD: March 2015 
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{ U/JPOSQ\ Recommendation #5 for he GIO: Review and 
update the Investment management Concept of 
Operations (CONOPS) to ensure that the investment 
management process aligns with federal quidance and 
best practices, and 


a. includes specific requirements for working with NRO 
subject matter experts from BPO and SED prior to the 
Implementation of each process step to ensure that the 
process will resull in effective budget and architecture 
decisions as appropriate; 

b. incorporates updated NRO-wide definitions of IT; 

©, utllizes the clarified CIO roles, responsibilities, 


authorities, ownership, and accountability included in 
the updated policies and Letters of Instruction: 

d. includes requirements for business cases to be 
developed and maintained for each proposed and 
existing [1 investment—the business cases should 
include cost, schedule, and performance measures and 
evidence of conformance with NRO 17 architecture to 
enable the effective selection, control, and evaluation 
of NRO iT assets and advise the DNRO on whether to 
continue, modify, or terminate IT programs or projects 
€, an and incorporates IT acquisition oversight; 
an 

f. includes requirements for using and complying with 
the Corporate 17 Procurement Program. 


(U//F Recommendation #6 for the CIO: Review and 
revise the IT Executive Committee (ITEC) and Investment 
Review Board (IRB) charters to ensure the establishment 
of an NRO investment review group that 


a. operates according to federal guidance and best 
practices; 

b. includes requirements for business cases to be 
developed and maintained for each proposed and 
existing IT investment—the business cases should 


include cost, schedule, and performance measures and | 


evidence of conformance with NRO IT architecture to 
enable the effective selection, control, and evaluation 
of NRO IT assets and advise the DNRO on whether to 


and 

c. includes specific criteria for determining which 
acquisitions and investments will be reviewed by the 
group, including a dollar threshold agreed to by the 
CIO and DNRO. 


(U//FODS}-Becommendation #7 for the af ~—s 








i 


continue, modify, or terminate IT programs or projects; 
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COMM/CIO 


COMM/CIO 


COMM/CiO 


(b)(3) 


6 C05109046 
TIN 


j (U/7POBOl The O1G evaluated the final draft CONOPS 








recommendation are addressed 


| (U//FOUS As a result of the COMM/CIO merger, the 


and met with CIO representatives to evaliate tis 
recommendation for cosure. [his recommendation 
remains open pending additonal actions to acdress 
recommendation parts cd, and «. 

Initial ECD: September 2015 


Current ECD: March 2016 


ITEC and IRB were disbanded. Their functions will be 
accomplished via the IT Exchange forum. The 
CONOPS will include a description of the IT Exchange 
forum functions and responsibilities. This 
recommendation remains open pending the OIG's 
final review of the CONOPS and evidence of actions 
to implement an NRO-wide investment review group. 


Initial ECD: September 2015 
Current ECD: March 2016 


(U//FOWRQ The CIO requested closure of parts c. and 
d. of this recommendation in July 2015. The O1G 
reviewed additional evidence provided, but will not 
close this recommendation until all elements of the 











(b)(3) 





| Initial ECD: September 2017 
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(U) Table B9: Inspection of the Special Communications Office 


Recommendation ; 
(U//FODS3}. Recommendation #12 for the Director, Special 
Communications Office (SCO): Review all External 
Agreements (EA) for currency and relevance. Work with 
OPS t update and convert Memoranda of Agreement to 
interagency Agreements as appropriate. 


Office _Status 
=o (6)(1) 














: inital ECD: December 2014 





(U) Table B10: Joint Inspection of Aerospace Data Facility East and National 
Geospatial-Intelligence Agency-Franconia 


Recommendation ; Office _ Status 
(U/JPobea Recommendation ADF-E/NGA-F-12-131: : MOD : (U) Due to an NRO restructuring that is stil ip 
Establish or update a written process for timely reporting = transition, O1G is working with various NRO 
and relmbursement for suppli ices | : components to determine and reassign responsibility 
accordance with the NRO/NG : of this recommendation to the appropriate 
(b)(3) component. 

: Initial ECD: July 2014 


MOD | (U) Due to an NRO restructuring that is still in 

| transition, OIG is working with various NRO 

| components to determine and reassign responsibility 
(b)(3) of this recommendation to the appropriate 
component. 


| Initial ECD: January 2016 


: (U) Due to an NRO restructuring that is stll in 

: transition, OIG is working with various NRO 

: components to determine and reassign component 
: responsibility for this recommendation, 


Initial ECD: December 2015 


| (U/7PSNQ) ND 10-2 was finalized in November 2014. 
| Anticipate approval of the associated NRO 

| Instructions (NI) (NI 10-2-1, Real Estate Acquisition 

| and disposal, and NI 10-2-2, Maintenance, Repair, 

| Improvement, and Construction Acquisition) in April 

; 2016. 


| Initial ECD: July 2014 


(UJTPSsQ) Recommendation ADF-E/NGA-F-12-209: OS&CI : (UJ) OS&CI completed coordination of the draft NRO 
Develop, communicate, and implement a policy/process : Directive and two-associated NRO Instructions that 
that identifies roles and responsibilities for each step in | govern and implement the 

accreditation process. (b)(3) 1G is awalling receipt oF The Thal (b)(3) 
| approved version tat hes been submitted to the 
: Director, OSECI for signature. 


Initial ECD: August 2015 
(U//FOUS Accreditation is dependent on completing 


| the identification and assessment of government and 
__industry site assets with potential undocumented 





























(UPOSQ) Recommendation ADF-E/NGA-F-12-202: 
Re-examine and update the current ADF-East| 
NRO and NGA. 





































(U7TPSMQ) Recommendation ADF-E/NGA-F-12-205: 
Finalize and publish NRO Directive (ND) 10-2, Facilities 
Acquisition Planning and Execution and associated NRO 
Instructions. 



































OS&CI 


(b)(3) 


(U/]PO8Q\ Recommendation ADF-E/NGA-F-12-210: 
acre and implement a plan/timeline to review and 





accredi 




















i Initial ECD: August 2014 


(UPouQ) Recommendation ADE-E/NGA-F-1 2-223 for (b ) ( 3) 
Commander IcOMM 
Enoure Systenis Administiaters report and document the 
Status of information assurance vulnerability alert (AVA) 
patches and Updates in accordance with NRO Corporate b)\(3 ~‘Tnitial ECD: April 2015 
Business Process instruction (CBP)) 50-2) for all ADE-E ( )( ) 

mission systems. 
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(U) Table B11: Audit of the NRO Management, Oversight, and Use of Federally 
Funded Research and Development Centers 


wanes ; Office _ Status 


(UFO Recommendation #4 for the NRO delegated BPO - (0) As noted in the marks to the Infe/igence 

official responsibie for the NRO Federally Funded . Authorization Act for Fiscal Year 2016, the House 
Research and Development Centers (FFRDC) portfolio: + Permanent Select Committee on Intelligence 

Develop and implement oversight controls to provide » recommended the NRO Inspector General conduct a 
assurance that the PPROC performed the tasks assigned » follow-up review to essess the effectiveness of the 
and properly billed the NRO for the work performed. + Management Changes taking place with SED and to 
determine whether similar management Changes are 
+ being Implemented within other elements of the NRO. 
+ The OIG will keep this recommendation open pending 
_ the outcome of this future follow-on review, 


i Initial ECD: February 2015 








(U//FOUQ) Table B12: (U) Inspection of the Survivability Assurance Office (SAO) 


Recommendation ; Office _ Status 


(UPRQ Recommendation #1 for the DNRO: Clarify the DNRO (U//FODBLSAO submitted the final compartmented 
roles, responsibilities, and authorities of the SAO and : addendum to the DNRO for review and signature end 
document in a compartmented addendum to the SAO : of March. 

(NGP), Senior Leadership Roles and Responsibilities | Current ECD: July 2016 


i (U//F SAO submitted the final compartmented 
addendum ® the DNRO for review and signature at 
the end of March. Additionally, the SAO Annex to the 
NGP now contains a statement indicating the 
compartmented addendum will be filed and 
maintained within SAO. 


Initial ECD: January 2015 
Current ECD: July 2016 


UY Recommendation #34 for the DNRO: Task (U//FOUDNI additions and changes to the 

SAO and SED jointly with the responsibility te coordinate resiliency documentation delayed community 

with the Director of National Intelligence (DNI) and DoD _ introduction of the document to June 2016 with 

for the development, definition, and documentation of : planned approval in August 2016. Completion date of 

enterprise space protection and resiliency. : the document is subject to the Intelligence 
Community Capabilities Requirements Council review 
and signature process. 


: Inital ECD: September 2015 
: Current ECD: December 2016 


(U) The 30 March 2016 signed NI 130-1-6, NRO Life 
: Cycle Readiness, Addendum 1, User Guide, includes 

: protection and resiliency entrance and exit criteria 

: checklists and artifacts for life cycle readiness events 
: to ensure resiliency is addressed within the 

: requirements and design reviews for each NRO Major 
: System Acquisition. SED is revising NRO Directive 82- 
: 7a, NRO Infrastructure Protection, to define 

: architecture resiliency roles and responsibilities and 

i ensure agreement with the NRO's current policy 

: structure. 


Initial ECD: March 2015 
: Current ECD: April 2016 








(U//F Recommendation #2A for the Director, SAO: 
Update theSSAO Governance Plan to incorporate the 
newly defined roles and responsibilities in the SAO LOL. 















(yO Reconmendaton #3B for the DNRO: Task 
SED with theésresponsibility to ensure that protection and 
resiliency are addressed as a part of requirements/design 
reviews for each major system acquisition. 
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(U/ [EQUOy 1 Table B13: (U) Audit of NRO Cyber Incident Detection and Response 


Recommendation 





(U]Pose3Recommendation #2 for the Director, COMM: : COMM 


Office _ Status 











Ensurd 








(b)(3) 








| ify BCCOIGance WEN IAteligénce Community 
Btandard (ICS) 502-01 and Inteligence Community 
Directive (ICD) 502, 











































































































































































(b)(3) 
(U//FOUSL.Recommendation #3 for the Director, COMM: COMM | (Us/PO¥Q,COMM/NRO Infrastructure Service 
Provider (NISP) b) (3) 
(b)(3) 
| Initial ECD: December 2016 
(U/POUS\.Recommendation #4 for the Director, COMM: comMM (b)(3) 
(b)(3) 
: Initial ECD: June 2015 
(U/POSQ, Recommendation #5 for the Director, OS&CI: OSRCI (b)(1) 
b)(3 
Initial ECD: July 2015 
| Current ECD: April 2016 
(U// Recommendation #6 for the Director, COMM: _ COMM (b)(3) 
(b)(3) 
( U/EGUDSRecommendation #7 for the Director, COMM: | COMM (b)(3) 
(b)(3) 
| Initial ECD: April 2015 
| Current ECD: March 2016 
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(Ue Recommendation #8 for he Director, COMM: 








comm (b)(3) 
(b)(3) 

















: inital ECD: June 2015 
: Current ECD: March 2016 





(UTTPELO) Recommendation #9 for the Director, COMM: 


COMM 











19) (b)(3) 








Initial ECD: June 2016 




















BL. PO USA, FVEY 


(U) Table Bi4: Follow-up Review of NRO Portable Electronic Devices Part II — 
Training for Personnel with Government-Controlled Portable Electronic Device 
Oversight Responsibilities 


Recommendation Office Status 


CU Recommendation #1 for the Director, COMM COMM : (U) COMM updated and coordinated NRO Directives 
in coordination with the Director, OS&CI: Issue new : and instructions clarifying roles and responsibilities 
guidance or update existing guidance to clarify what : regarding training and program management. 
Specific positions or individuals are required to take the : Comments are currently being adjudicated and upon 
Government-controlled Portable Electronic Device (GPED) : final approval and publication, COMM will deliver the 
Management and Inspection computer-based training, : guidance documents to OIG for closure consideration. 





including the timing and frequency with which the training [nit : 

should be taken; who (6 responsible to hold individuals : mee — a 
accountable for taking the training: and what, if any, i Current ECD: April 2016 
other GPED specific training course(s) may satisfy training : 

requirements. 
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